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(54) Safety optimization in microprocessor-controlled implantable devices 



(57) A microprocessor-controlled implantable cardi- 
ac stimulating device (100) having a normal mode, an 
intermediate mode, and a backup pacing mode is pro- 
vided. The device (100) switches from one mode to an- 
other in response to the detection of any one of an ad- 
dress error, parity error, opcode error, or watchdog timer 
error. The microprocessor (202) is shut down during the 
delivery of a cardioversion or defibrillation shock in order 
to prevent signals produced by the microprocessor 
(202) from being subjected to transient electrical sig- 
nals. The interrupt registers (208) of the microprocessor 
(202) are also disabled during the delivery of a cardio- 
version or defibrillation shock. In an alternative embod- 
iment, an implantable cardiac stimulating device (100) 
is provided with redundant microprocessors (952, 954) 
in order to detect malfunctions of the microprocessors 
(952, 954). 
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Description 

This invention relates to microprocessor-controlled 
implantable medical devices, and particularly to micro- 
processor-controlled implantable cardiac stimulating 
devices. More particularly, this invention relates to safe- 
ty optimization apparatus and methods for use in micro- 
processor-controlled implantable cardiac stimulating 
devices. 

Implantable cardiac stimulating devices which pro- 
vide electrical stimulation in response to a variety of 
pathological cardiac arrhythmias are known. Some im- 
plantable cardiac stimulating devices provide "tiered 
therapy," in which the type of electrical stimulation pro- 
vided is determined in accordance with the severity of 
the arrhythmia, with more aggressive therapies being 
applied in response to more severe arrhythmias. For ex- 
ample, such devices may respond to relatively less se- 
vere forms of tachycardia by delivering antitachycardia 
pacing pulses of about 25 ujoules to about 30 ujoules 
in a sequence known to interrupt such episodes. In re- 
sponse to relatively more severe forms of tachycardia, 
the implantable cardiac stimulating device may deliver 
a low energy cardioversion shock on the order of about 
2 joules to about 5 joules, either in combination with, or 
as an alternative to, antitachycardia pacing pulses. In 
response to an occurrence of an even more severe ar- 
rhythmia, for example, ventricular fibrillation, the im- 
plantable cardiac stimulating device may deliver a high 
energy defibrillation shock on the order of about 10 
joules to about 40 joules. 

Implantable cardiac stimulating devices which pro- 
vide pacing pulses to cardiac tissue to maintain a heart 
rate at a physiologically acceptable rate (i.e., to provide 
"bradycardia pacing support") are also known. Brady- 
cardia pacing support may be provided by a dedicated 
pacemaker, or by a device that is also capable of pro- 
viding other forms of therapy, such as tiered therapy. 

Implantable cardiac stimulating devices typically 
contain a microprocessor to control the administration 
of the various pacing therapies and cardioversion and 
defibrillation shocks. Implantable cardiac stimulating 
devices typically may store preprogrammed informa- 
tion, and physiological and electrophysiological infor- 
mation gathered from the patient's heart, in one or more 
memory devices contained within the device. 

If data stored in a memory device are unexpectedly 
altered or corrupted, inappropriate pacing may be ad- 
ministered to the patient's heart with possible adverse 
effects. For example, corrupted data may cause the de- 
vice to fail to provide pacing pulses, or may cause the 
device to deliver a defibrillation shock at an inappropri- 
ate time. Malfunction of the microprocessor may also 
cause an inappropriate form of therapy to be delivered. 

Microprocessor malfunction and corruption of data 
stored in memory devices can occur for several rea- 
sons. For example, in an implantable cardiac stimulating 
device, power is supplied by a battery contained within 



the device. If the battery is unable to supply sufficient 
power, the memory devices or the microprocessor may 
not receive enough power to function correctly. This may 
cause data stored in memory devices to be lost or al- 

s tered, or may cause the microprocessor to malfunction. 
Memory devices in an implantable device also may 
not function properly if they are subjected to x-rays, mi- 
crowave radiation, or magnetic fields while implanted 
within the patient. For example, a patient may receive 

10 x-rays which may cause data stored in memory devices 
to be altered. As another example, the patient may pass 
through a strong magnetic field which may cause data 
to be altered. Random access memory devices (RAM) 
may be particularly sensitive to these sources of errors. 

15 Calfee et al. U.S. Patent No. 4,390,022 ("the '022 
patent") describes an implantable cardiac pacer that 
verifies the parity of a 7-bit instruction byte stored in 
RAM in order to detect a possible error in the instruction 
byte. The '022 patent describes an eighth bit in addition 

20 to the 7-bit instruction byte to indicate the parity of the 
instruction byte. However, the described method suffers 
from certain disadvantages. For example, the described 
method only checks the parity of the 7-bit instructions 
stored in RAM. The '022 patent does not describe 

25 checking the parity of other data stored in RAM. In view 
of this drawback, it would be advantageous to provide 
parity checking of all data stored in RAM so as to provide 
greater error protection and increase the safety of the 
patient. 

30 The '022 patent also describes moving the program 
counter of the implantable device to a fixed rate pacing 
program when a parity error of an instruction byte is de- 
tected. Although this may prevent the parity error from 
causing inappropriate pacing to be administered, it suf- 

35 fers from disadvantages. For example, once a single 
parity error in an instruction byte is detected, the device 
can only utilize the fixed rate program, thus limiting the 
patient to fixed-rate pacing. Therefore, after only a sin- 
gle parity error in an instruction byte is detected, the de- 

40 vice is unable to gather information from the patient's 
heart or use information preprogrammed into the de- 
vice. However, a single parity error does not always in- 
dicate that the memory device is defective and no longer 
useful. In view of these disadvantages, it would be de- 

45 sirable to provide a mode of operation for the implanta- 
ble device which would eliminate the source of error 
while still allowing the microprocessor to use the mem- 
ory devices. 

Furthermore, the '022 patent suffers from the dis- 
50 advantage that fixed rate pacing is administered by a 
program. The program instructions for the fixed rate 
pacing may themselves become corrupted, or the mi- 
croprocessor which executes the program may mal- 
function, thereby causing even the fixed rate pacing pro- 
55 gram to fail. In view of these drawbacks, it would be ad- 
vantageous to provide a pacing mode which can oper- 
ate independent of the microprocessor and associated 
memory devices. Such a pacing mode would increase 
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the safety of the device and reduce the likelihood of in- 
appropriate therapy being applied to the patient's heart. 

Another source of errors in implantable cardiac 
stimulating devices are transient electrical signals which 
may be generated during the delivery of cardioversion 
and defibrillation shocks. These transient electrical sig- 
nals may cause data to be altered. It would therefore be 
advantageous to provide error prevention methods and 
apparatus which would prevent these errors. 

The invention is defined in the independent claims 
attached hereto. Preferred features of the invention are 
defined in the dependent claims attached hereto. 

In accordance with the present invention, an im- 
plantable cardiac stimulating device is provided having 
error checking apparatus and methods for determining 
if the device is functioning correctly. In response to the 
detection of an error, the device is able to switch be- 
tween a normal mode, an intermediate mode, and a 
backup pacing mode. The intermediate mode is de- 
signed to significantly reduce the possibility of inappro- 
priate pacing therapy being administered to the patient's 
heart, while still providing an advanced level of therapy. 

A preferred embodiment of an implantable cardiac 
stimulating device constructed in accordance with the 
present invention has a microprocessor, a memory de- 
vice coupled to the microprocessor, a pulse delivery cir- 
cuit coupled to the microprocessor for delivering an 
electrical stimulation pulse to a patient's heart, a backup 
pacing circuit for delivering backup pacing to the pa- 
tient's heart, and at least one error detection circuit for 
detecting errors in the implantable cardiac stimulating 
device. The device preferably has switching circuitry 
coupled to each of the microprocessor, the error detec- 
tion circuit, and the backup pacing circuit, for switching 
the implantable cardiac stimulating device from a nor- 
mal mode to an intermediate mode in response to a first 
error detected by the error detection circuit. The switch- 
ing circuitry switches the implantable cardiac stimulating 
device from the intermediate mode to a backup pacing 
mode in response to a second error detected by the er- 
ror detection circuit. In the normal mode, the pulse de- 
livery circuit is controlled by the microprocessor, and the 
microprocessor is able to store data in and retrieve data 
from the memory device. In the intermediate mode, the 
pulse delivery circuit is still controlled by the microproc- 
essor, and the microprocessor continues to be able to 
store data in the memory device. However, the micro- 
processor is only able to retrieve data that was stored 
in the memory device after the implantable cardiac stim- 
ulating device entered the intermediate mode. Thus, da- 
ta which were stored in the memory device prior to en- 
tering the intermediate mode are not used by the micro- 
processor. In the backup pacing mode, the microproc- 
essor is disabled and the backup pacing circuitry is ac- 
tivated. The backup pacing circuit preferably is a "hard- 
wired" circuit which can operate without microprocessor 
intervention. 

In a preferred embodiment, the implantable cardiac 



stimulating device is capable of detecting several differ- 
ent types of errors which may occur. 

One type of error detection which is provided by the 
present invention is parity error detection. In accordance 
5 with the present invention, all data units which are stored 
in a RAM preferably are given parity bits. Data are pref- 
erably stored in 9-bit units in which the ninth bit indicates 
the parity of the other 8 bits. The present invention thus 
overcomes the disadvantages in previous devices be- 
cause all types of data incorporate parity detection, 
thereby increasing the patient's safety. 

Parity error detection is preferably accomplished by 
a parity checker. The parity checker compares the parity 
bit of a data unit stored in the memory device to the parity 
of the data bits and generates an error signal if the parity 
bit is not correct. If a parity error is detected while the 
device is in the normal mode, the device is set to the 
intermediate mode. If a parity error is detected while the 
device is in the intermediate mode, the device is set to 
the backup pacing mode. 

Another type of error checking is provided by an ad- 
dress decoder. When the microprocessor attempts to 
access a memory location, the address decoder de- 
codes the address and determines if the address is a 
proper address. If the address is not a proper address, 
an error signal is generated. An example of an improper 
address is an address which is higher than the highest 
valid addressable location. If the addressable location 
is determined to be invalid and the device is in the nor- 
mal mode, the device is set to the intermediate mode. 
If the device is in the intermediate mode and an address 
error is detected, the device is set to the backup pacing 
mode. 

Yet another type of error detection is provided by an 
opcode checker. Opcodes identify the instructions exe- 
cuted by the microprocessor. In accordance with the 
present invention, the opcode checker preferably oper- 
ates by first receiving a signal which indicates that the 
microprocessor is about to fetch an opcode from the 
memory device. The opcode checker then determines 
if the opcode is a valid opcode. If the opcode is not a 
valid opcode an error signal is issued. An example of an 
invalid opcode is an opcode which is not used by the 
microprocessor. If the opcode is determined to be invalid 
and the device is in the normal mode, the device is set 
to the intermediate mode. If an opcode error is detected 
while the device is in the intermediate mode, the device 
is set to the backup pacing mode. 

Another type of error detection is performed by a 
watchdog timer circuit. The watchdog timer circuit is pro- 
vided in order to determine if the microprocessor is func- 
tioning correctly. In a preferred embodiment, the watch- 
dog timer circuit also functions as the switching circuit 
which switches the device between the normal, interme- 
diate, and backup modes. A preferred method of oper- 
ating the watchdog timer in order to detect malfunctions 
of the microprocessor is as follows. First, an interrupt 
generating circuit provides an interrupt signal to the mi- 
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croprocessor. If the microprocessor is functioning cor- 
rectly, it is able to communicate an acknowledgment sig- 
nal to the watchdog timer circuit in response to receiving 
the interrupt signal. If a proper acknowledgment signal 
is not received by the watchdog timer circuit from the 
microprocessor within a predetermined interval of time 
after the microprocessor receives the interrupt signal, 
the device is switched to the backup pacing mode. Thus, 
detection of an error by the watchdog timer circuit caus- 
es the device to enter the backup pacing mode regard- 
less of whether the device was operating in the normal 
mode or the intermediate mode when the error was de- 
tected. 

In accordance with a still further safety optimization 
feature of this invention, the microprocessor is shut 
down when a cardioversion or defibrillation shock is de- 
livered to the patient's heart. Signals generated by the 
microprocessor therefore are not subjected to potential- 
ly corrupting transient electrical signals. In order to ac- 
complish this, just prior to the delivery of electrical stim- 
ulation to the patient's heart, the microprocessor pro- 
grams a timer to send a wakeup signal to a system clock 
generator. The timer is programmed so that it sends a 
wakeup signal to the system clock generator a prede- 
termined interval of time after the timer is programmed. 
The microprocessor then sends a signal to the system 
clock generator which prevents the microprocessor 
from receiving clock signals, thereby halting processing 
by the microprocessor. The cardioversion or defibrilla- 
tion shock is delivered while the microprocessor is shut 
down. After the predetermined interval of time has 
elapsed (which is longer than the time it takes to deliver 
the cardioversion or defibrillation shock), the timer is- 
sues the wakeup signal. The wakeup signal enables the 
microprocessor to receive the clock signals from the 
system clock generator, thereby allowing processing by 
the microprocessor. 

In addition to shutting down the microprocessor dur- 
ing the delivery of a cardioversion or defibrillation shock, 
interrupt registers of the microprocessor are disabled 
during delivery of a cardioversion or defibrillation shock. 
Prior to shutting off the clock signal, the microprocessor 
switches a gating circuit which disconnects the inputs of 
the microprocessor interrupts. The interrupt registers 
therefore are not subject to transient electrical signals, 
which may inadvertently trigger the interrupt registers. 

In another embodiment, a high voltage interface cir- 
cuit is used to monitor the charging of the high voltage 
energy in the output capacitor and/or to monitor the 
amount of shockdelivered tothe patient. If a malfunction 
occurs, the microprocessor is notified and appropriate 
action can be taken. 

In an alternative embodiment, safety optimization is 
accomplished by providing redundant microprocessors. 
In this embodiment the implantable cardiac stimulating 
device has a first microprocessor, a second microproc- 
essor, a comparator connected to the first and second 
microprocessors, an interface connected to the compa- 



rator and the first and second microprocessors, and a 
data bus connected to the interface. The interface re- 
ceives signals from the data bus and transfers a copy 
of the signals to each of the first and second microproc- 

5 essors. The first microprocessor processes the signals 
to produce a first processed signal, while the second mi- 
croprocessor processes the signals to produce a sec- 
ond processed signal. Each of the first and second proc- 
essed signals are communicated to the comparator. The 

10 comparator compares the first and second processed 
signals in order to determine if the first and second mi- 
croprocessors are functioning correctly. If the signals 
are not substantially identical, the microprocessors are 
shut down and the backup pacing circuitry is activated. 

15 in this manner, an improperly functioning microproces- 
sor may be prevented from causing improper pacing 
and cardioversion or defibrillation shocks to be delivered 
to the patient. 

In its preferred form, the method of the invention as 

20 defined in Claim 1 4 further includes the following steps: 

1. The method wherein the error detection circuit 
comprises a watchdog timer circuit, and wherein the 
method further comprises the steps of: 

25 

providing an interrupt signal to the microproc- 
essor, the microprocessor being able to com- 
municate an acknowledgement signal to the 
watchdog timer circuit in response to receiving 
30 the interrupt signal; 

switching the implantable cardiac stimulating 
device to the backup pacing mode when a prop- 
er acknowledgment signal is not received by 
the watchdog timer circuit from the microproc- 
35 essor within a predetermined interval of time af- 

ter the microprocessor receives the interrupt 
signal. 

2. The method of 1 , further comprising the step of: 
40 switching the implantable cardiac stimulating 

device to the backup pacing mode if more than one 
acknowledgment signal is received by the watch- 
dog timer circuit within a predetermined interval of 
time. 

45 

In its preferred form, the method of the invention as 
claimed in Claim 20 further includes the following steps: 

1 . The method wherein the comparing step com- 
so prises the step of: 

determining that the microprocessors are not 
functioning correctly when the first and second 
processed signals are not substantially identical. 

2. The method further comprising the step of: 

55 disabling each of the first and second micro- 

processors when the comparator determines that 
the first and second microprocessors are not func- 
tioning correctly. 
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In its preferred form the method of Claim 28 further 
includes the following steps: 

1. The method wherein th'e electrical stimulation 
comprises one of cardioversion shocks or defibril- 
lation shocks. 

2. The method wherein the predetermined interval 
of time is longer than the time of delivery of the elec- 
trical stimulation. 

3. The method further comprising, when the im- 
plantable cardiac stimulating device further com- 
prises a gating circuit connected to the microproc- 
essor and having a first position which allows sig- 
nals to be communicated to interrupt registers of the 
microprocessor, and a second position which pre- 
vents signals from being communicated to the in- 
terrupt registers, the step of: 

switching the gating circuit from the first posi- 
tion to the second position just prior to the delivery 
of electrical stimulation to the patient's heart in order 
to prevent the interrupt registers from receiving 
electrical signals during the delivery of electrical 
stimulation of the patient's heart. 

Embodiments of the invention will now be de- 
scribed, by way of example with reference to the draw- 
ings of which: 

FIG. 1 is a schematic diagram of a preferred em- 
bodiment of an implantable cardiac stimulating de- 
vice which includes backup pacing circuitry in ac- 
cordance with the present invention; 
FIG. 2 is a schematic diagram showing the process- 
ing and control unit of FIG. 2 including fault detec- 
tion circuitry in accordance with the present inven- 
tion; 

FIG. 3 is a flow diagram of steps performed by the 
microprocessor shown in FIG. 2 in order to respond 
to the watchdog timer circuit shown in FIG. 2; 
FIG. 4 is a flow diagram of an error detection se- 
quence carried out by the watchdog timer circuit 
shown in FIG. 2; 

FIGS. 5-7 are flow diagrams of a fault detection se- 
quence carried out by the watchdog timer circuit 
shown in FIG. 2 in order to provide switching be- 
tween modes in accordance with the present inven- 
tion; 

FIG. 8 is a flow diagram for the shutdown of the mi- 
croprocessor shown in FIG. 2 during delivery of a 
cardioversion or defibrillation shock; 
FIG. 9 is a schematic diagram of an alternative 
processing and control unit that includes redundant 
microprocessors in accordance with the present in- 
vention; and 

FIG. 1 0 is a flow diagram for the error checking per- 
formed in order to determine if the first and second 
microprocessors of FIG. 9 are functioning correctly. 



FIG. 1 is a schematic diagram of an implantable car- 
diac stimulating device 100 having backup pacing cir- 
cuitry in accordance with the present invention. The im- 
plantable cardiac stimulating device 100 preferably has 

5 three modes of operation - a normal mode, an interme- 
diate mode, and a backup pacing mode. At any given 
time, the particular mode in which the device is operat- 
ing is determined by the number and nature of errors 
which have been detected within the device. Before de- 

10 scribing the modes of operation and error detection 
methods and circuitry, a general description of device 
100 is provided so that the features and advantages of 
the invention may be better understood. 

The implantable cardiac stimulating device 100 in- 

15 eludes circuitry 102 which is responsible for regulation 
and delivery of pacing therapy as well as overall opera- 
tional control of the device 100. Also included is circuitry 
1 04 dedicated to the control, generation, and delivery of 
cardioversion and defibrillation shocks. The implantable 

20 cardiac stimulating device 100 preferably administers 
therapeutic shocks (i.e., cardioversion or defibrillation 
shocks) or pacing pulses to a patient's heart 1 06 in order 
to interrupt cardiac arrhythmias or supply artificial pac- 
ing, respectively. However, the present invention also 

25 may be practiced with dedicated implantable cardiovert- 
ers and defibrillators, as well as dedicated implantable 
pacing devices. 

The implantable cardiac stimulating device 100 ad- 
ministers therapeutic shocks to the patient's heart 106 

30 through a plurality of shocking leads 1 08. Pacing pulses 
are delivered to the patient's heart 1 06 through a pacing 
lead system 110. However, the therapeutic shocks and 
pacing pulses may be delivered through the same leads 
(not shown). The pacing lead system 1 1 0 also serves to 

55 sense intrinsic cardiac activity during periods when elec- 
trical stimulation is not being applied to the heart. The 
lead system 110 feeds physiological and electrophysio- 
logical data in the form of analog signals from the pa- 
tient's heart 106 to a sensing circuit 112. Furthermore, 

40 the implantable cardiac stimulating device 100 is pref- 
erably enclosed within an electrically conductive case 
(not shown) which may be used as an electrode in the 
delivery of pacing pulses. 

The sensing circuit 112 typically amplifies the in- 

45 coming analog signals and filters out unwanted noise. 
The amplified signals are then digitized and formatted 
for use by a processing and control unit 114. The 
processing and control unit 1 1 4 analyzes the digital sig- 
nals in order to determine the appropriate therapy. 

50 The processing and control unit 1 1 4 communicates 
with a pacing pulse regulation and delivery circuit 116 
which generates and transmits electrical pulses to the 
patient's heart 106. The pacing pulse regulation and de- 
livery circuit 1 1 6 includes a backup pacing circuit 1 1 8 for 

55 use as described in detail below. The processing and 
control unit 1 1 4 determines the appropriate lead or leads 
of the lead system 1 1 0 through which the therapy is de- 
livered. 
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In order to deliver a cardioversion or defibrillation 
shock, the processing and control unit 114, through a 
serial interface 1 20, instructs a DC/DC converter control 
circuit 122 to begin charging a pair of capacitors 124 in 
series with each other to a target voltage. The DC/DC 
converter control circuit 122 in turn, instructs a shock 
delivery circuit 126, through an isolation circuit 128, to 
begin charging the capacitors 1 24. The DC/DC convert- 
er control circuit 122 performs the control and logic op- 
erations needed by the shock delivery circuit 1 26 to cre- 
ate a high frequency oscillated high voltage for applica- 
tion to the capacitors 1 24. A defibrillation shock delivery 
control circuit 130 performs the logic and control oper- 
ations needed to deliver a desired therapeutic shock to 
the patient's heart 106. 

In a preferred embodiment, the isolation circuit 128 
includes a transformer interface (not shown) which is 
used to electrically isolate the low voltage circuits of both 
the defibrillation shock delivery control circuit 130 and 
the DC/DC converter control circuit 122 as well as the 
circuitry 102 from exposure to high voltages. 

Once the defibrillation shock delivery control circuit 
130 is informed that capacitors 124 are sufficiently 
charged, the processing and control unit 114 then in- 
structs the defibrillation shock delivery control circuit 
1 30 to direct the shock delivery circuit 1 26 to administer 
the shock to the patient's heart 106. 

A high voltage interface circuit 121 is used to mon- 
itor the charging of high voltage energy in the output ca- 
pacitors 124 and/or are capable of monitoring the 
amount of shock delivered to the patient. If any malfunc- 
tion occurs, the microprocessor is notified. Depending 
on the type of failure, the microprocessor can convey 
the problem at the next interrogation, activate an annun- 
ciator to alert the patient to see his physician, and po- 
tentially shut down the defibrillation shock delivery con- 
trol circuit 130. 

Communication with and programming of the im- 
plantable cardiac stimulating device 100 is accom- 
plished by a programmer (not shown) which communi- 
cates with the device 100 through a telemetry circuit 
1 40. Telemetry data is transmitted to the processing and 
control unit 114 through a memory 142. 

An external RAM 144 connected to the processing 
and control unit 114 is provided for storing data. 

FIG. 2 shows a processing and control unit 200 
(suitable for use as the processing and control unit 114 
of FIG. 1) constructed in accordance with the present 
invention. The processing and control unit 200 includes 
a microprocessor 202 which is connected to a data bus 
204. A gating circuit 206 which is controlled by the mi- 
croprocessor 202 controls access to interrupt registers 
208 of the microprocessor 202. An internal RAM 210 
and a ROM 212 are provided for storing data. A parity 
generator 214, a parity checker 216, a watchdog timer 
circuit 218, an address decoder 220, a real time clock 
logic 222, a timer 224, an opcode checker 226, and a 
system clock generator 228 are provided for error 



checking. The data bus 204 communicates with the 
sensing circuit 112, the pacing regulation and delivery 
circuit 116, the memory 142, the external RAM 144, and 
the serial interface 120 shown in FIG. 1 . 

5 In addition to reading data from the ROM 212, the 

processing and control unit 200 can read data from and 
write data to the external RAM 1 44 (FIG. 1 ), and the in- 
ternal RAM 210. Typically, the external RAM 144 (FIG. 
1) has a larger storage capacity than the internal RAM 

10 210. Although FIG. 1 shows an implantable cardiac 
stimulating device 100 having the external RAM 144, in 
an alternative embodiment (not shown) the external 
RAM 144 could be eliminated in order to increase proc- 
essor speed, reduce power consumption and reduce 

15 the overall size of the implantable device. 

The interaction of the processing and control unit 
200 with the various memory storage devices is depend- 
ent on the mode in which the implantable cardiac stim- 
ulating device is operating. In a preferred embodiment 

20 of the present invention, there are three modes of oper- 
ation available to the implantable cardiac stimulating de- 
vice 100 - the normal mode, the intermediate mode, 
and the backup pacing mode. 

In the normal mode the microprocessor 202 is able 

25 to use data and instructions stored in the ROM 212, the 
internal RAM 210, and the external RAM 144 (FIG. 1). 
The microprocessor 202 is able to store data in the in- 
ternal RAM 210 and the external RAM 144 (FIG. 1), and 
is able to read data from the internal RAM 210, the ex- 

30 ternal RAM 144 (FIG. 1), and the ROM 212. Program 
instructions and data which are provided by the pro- 
grammer (not shown) via the telemetry 1 40 (FIG. 1 ) can 
be stored in and then retrieved from the internal RAM 
210 and the external RAM 144 (FIG. 1). The microproc- 

55 essor 202 also can store and then retrieve physiological 
and electrophysiological data gathered by the sensing 
circuit 112 (FIG. 1) in the internal RAM 210 and the ex- 
ternal RAM 144 (FIG. 1). In the normal mode the im- 
plantable cardiac stimulating device 100 is therefore 

40 able to provide the most advanced level of pacing ther- 
apy. In particular, the pacing therapy may be pro- 
grammed by a physician to be especially suited to the 
needs of the patient under treatment, and may also be 
adjusted in accordance with data gathered from the pa- 

45 tient's heart by the device. 

If an address, parity, or opcode error (each of which 
is described below) is detected while the implantable 
cardiac stimulating device 100 is in the normal mode, 
the device 1 00 is set to the intermediate mode either by 

50 the watchdog timer circuit 218 or other switching circuit- 
ry (not shown). Upon entering the intermediate mode, 
all information stored in the internal RAM 210 and the 
external RAM 144 (FIG. 1) is considered corrupt. Thus, 
although the microprocessor 202 can still use the inter- 
ns nal RAM 21 0 and the external RAM 1 44 (FIG. 1 ) to store 
and retrieve information while in the intermediate mode, 
any information already stored at the time the device is 
switched to the intermediate mode is ignored by the mi- 
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croprocessor 202 and may be over-written. In the inter- 
mediate mode, the microprocessor can, for example, 
use the internal RAM 21 0 or the external RAM 1 44 (FIG. 
1 ) as a scratch pad to perform a calculation, or to store 
data gathered from the patient's heart 1 06. However, the 
microprocessor 202 will ignore data which was stored 
in the internal RAM 210 or the external RAM 144 (FIG. 
1) prior to entering the intermediate mode. In the inter- 
mediate mode, the microprocessor 202 is able to re- 
trieve data from the ROM 212. 

The intermediate mode thus overcomes the disad- 
vantages of previous devices of switching directly to a 
fixed rate program upon detecting a single parity error. 
In the device 100 of the present invention, the detection 
of a parity error causes the microprocessor 202 to con- 
sider data stored in the internal RAM 21 0 and the exter- 
nal RAM 144 (FIG. 1) corrupt. The microprocessor 202 
can, however, continue to use the internal RAM 210 and 
the external RAM 144 (FIG. 1). 

If any of an address, parity, or opcode error is de- 
tected while in the intermediate mode, the device 1 00 is 
set to the backup pacing mode. Furthermore, if a watch- 
dog time-out occurs or a system interrupt is telemetric- 
ally issued while the device 100 is in the intermediate 
mode or the normal mode, the device 100 is set to the 
backup pacing mode. In the backup pacing mode the 
microprocessor 202 is disabled and the backup pacing 
circuit 118 (FIG. 1) of pacing pulse regulation and deliv- 
ery circuit 116 (FIG. 1) is activated. The backup pacing 
circuit 118 (FIG. 1 ) administers backup pacing to the pa- 
tient's heart until an appropriately qualified person can 
service the device. 

The backup pacing circuit 118 (FIG. 1) preferably is 
a dedicated circuit that does not require the input of any 
signals from the microprocessor 202 in order tof unction. 
In a preferred embodiment, the backup pacing circuit 
118 (FIG. 1) provides VVI pacing therapy. In VVI pacing, 
if a heartbeat signal is not detected from the patient's 
ventricle during a fixed interval of time following the pre- 
vious heartbeat, whether intrinsic or paced, a pacing 
pulse is delivered to the ventricle of the patient's heart 
106. 

By providing a dedicated backup pacing circuit 118 
(FIG. 1 ) that does not require intervention by the micro- 
processor 202, the disadvantages of previously known 
devices are overcome. In particular, the backup pacing 
circuit 118 (FIG. 1) is highly reliable and cannot be dis- 
rupted by malfunction of the microprocessor 202 or cor- 
ruption of data stored in the internal RAM 210 and the 
external RAM 144 (FIG. 1). 

The error detection methods and circuitry used to 
determine the mode of operation of the implantable car- 
diac stimulating device 100 are now described. 

In order to detect possible errors of the microproc- 
essor 202 and related circuitry and to increase the safety 
of device 100, the watchdog timer circuit 218 and the 
real time clock logic 222 are provided. In addition to pro- 
viding error detection, the watchdog timer circuit 218 



preferably also controls the switching of the device 100 
between modes as described below. 

FIG. 3 shows the steps carried out by the microproc- 
essor 202 (FIG. 2) in responding to the watchdog timer 

5 circuit 218 (FIG. 2). The microprocessor 202 (FIG. 2) 
preferably is expected to respond to an interrupt signal 
which is preferably issued every two seconds by the real 
time clock logic 222 (FIG. 2) at step 300. The interrupt 
signal is received by the watchdog timer circuit 21 8 (FIG. 

10 2) and the microprocessor 202 (FIG. 2). Upon receiving 
the interrupt signal at step 302, the microprocessor 202 
(FIG. 2) sends an acknowledgment signal at step 304 
to the watchdog timer circuit 218 (FIG. 2) before the next 
interrupt signal is issued by the real time clock logic 222 

15 (FIG. 2). The acknowledgment signal preferably com- 
prises an 8-bit password comprising a randomly gener- 
ated 6-bit key and a 2-bit address code. The 2-bit ad- 
dress code specifies one of four possible addresses 
within the watchdog timer circuit 218 (FIG. 2), while the 

20 6-bit key is a randomly generated code. In order to prop- 
erly acknowledge the interrupt, the microprocessor 202 
(FIG. 2) provides the 6-bit key to the address specified 
by the 2-bit address code. Each time the microprocessor 
202 (FIG. 2) provides acknowledgment to the watchdog 

25 timer circuit 21 8 (FIG. 2), the watchdog timer circuit 218 
(FIG. 2) generates a new password comprising a new 
key and a new address code at step 306. The micro- 
processor 202 (FIG. 2) retrieves this password for use 
in the next acknowledgment at step 308. The initial 

30 password after a system reset is an 8-bit password in 
which all bits are "zeros." 

As shown in FIG. 4, the watchdog timer circuit 218 
(FIG. 2) first determines if acknowledgment is received 
within two seconds of the issuance of the interrupt signal 

55 at test 400. If acknowledgment has not been received 
within two seconds, the watchdog timer circuit 218 (FIG. 
2) sets the device 100 to the backup pacing mode at 
step 402. If acknowledgment has been received within 
two seconds, the watchdog timer circuit 218 (FIG. 2) 

40 then checks if the acknowledgment is proper at test 404. 
If the acknowledgment is not proper, the watchdog timer 
circuit 21 8 (FIG. 2) switches the device 1 00 to the back- 
up pacing mode at step 402. An acknowledgment is not 
proper if the microprocessor 202 (FIG. 2) does not pro- 

45 vide the 6-bit key to the address specified by the 2-bit 
address code, both of which were retrieved during the 
previous acknowledgment. If the acknowledgment is 
proper, the watchdog timer circuit 218 (FIG. 2) then de- 
termines if more than one acknowledgment has been 

50 received at test step 406. If more than one acknowledg- 
ment has been received, the watchdog timer circuit 218 
(FIG. 2) switches the device 100 to the backup pacing 
mode at step 402. More than one acknowledgment may 
be received if the microprocessor 202 (FIG. 2) is not 

55 functioning correctly. If the acknowledgment is proper, 
the process begins again with the issuance of a new in- 
terrupt signal. 

If the microprocessor 202 (FIG. 2) is functioning cor- 
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rectly, it will properly acknowledge the interrupt signal to 
the watchdog timer circuit 218 (FIG. 2) within two sec- 
onds. However, if the microprocessor 202 (FIG. 2) has 
failed or is functioning incorrectly (which may for exam- 
ple, be caused by a weakened battery), it may not prop- 
erly acknowledge the interrupt signal to the watchdog 
timer circuit 218 (FIG. 2). When this occurs, the watch- 
dog timer circuit 218 (FIG. 2) detects the error and im- 
plements backup pacing. The watchdog timer circuit 
218 (FIG. 2) thus may prevent the device 100 from de- 
livering inappropriate pacing or cardioversion/defibrilla- 
tion therapy to the patient's heart 106, thereby increas- 
ing the safety of the device 100. 

It will be clear to those skilled in the art that pass- 
words other than the 8-bit password described above 
may be used in accordance with the present invention. 
For example, the password could comprise a key having 
8 bits which are randomly generated with no address 
code. In this case, there would be only one address in 
the watchdog timer circuit 21 8 (FIG. 2) to which the key 
would be written, and a proper acknowledgment would 
require writing the 8-bit key to this address. 

It will also be clear to those skilled in the art that the 
interval between interrupt signals issued by the real time 
clock logic 222 (FIG. 2) can be a value other than two 
seconds. For example, the interrupt signal could be sent 
every one second. It is, however, important that the sig- 
nal be frequent enough to allow the backup pacing cir- 
cuitry to be activated without an undue delay between 
pacing pulses. 

Referring again to FIG. 2, further error checking is 
provided by the parity generator 214 and the parity 
checker 216. The parity generator 214 preferably is a 
conventional hardwired circuit which generates a parity 
bit for data which are stored in the internal RAM 210 or 
the external RAM 144 (FIG. 1). The parity checker 216 
preferably is a conventional hardwired circuit which 
checks the parity bit of data which are read from the in- 
ternal RAM 210 or the external RAM 144 (FIG. 1). 

The microprocessor 202 preferably manipulates 
data in 8-bit bytes. When data are stored in the external 
RAM 144 (FIG. 1) or the internal RAM 210 the parity 
generator 214 generates a ninth bit which indicates the 
parity of the 8 data bits. The 8 data bits and the parity 
bit are then stored in the external RAM 144 (FIG. 1) or 
the internal RAM 21 0. Information is thus stored in 9-bit 
units ~ 8 data bits and the corresponding parity bit. The 
parity bit preferably can be generated in a conventional 
manner, such as by determining the number of "ones" 
in the 8 data bits. If there are an even number of "ones, 
" the parity bit is set to "one," while an odd number of 
"ones" causes the parity bit to be set to "zero." Alterna- 
tively, the parity bit could be chosen so as to produce 
an even number of "ones" in the combined data and par- 
ity bits. 

When data are retrieved from the internal RAM 210 
or the external RAM 1 44 (FIG. 1 ) the parity checker 216 
checks the parity bit. If the parity bit is not correct, the 



parity checker 216 generates an error signal indicating 
that a parity error has been detected. The error signal 
is received by the watchdog timer circuit 21 8, which then 
switches the device 100 to the appropriate mode. The 

5 detection of a parity error may indicate that the data 
stored in the memory devices are corrupt and should 
not be used. If a parity error is detected while the device 
is in the normal mode, the device 1 00 is set to the inter- 
mediate mode either by the watchdog timer circuit 218 

10 or other switching circuitry (not shown). If a parity error 
is detected while the device is in the intermediate mode, 
the device 100 is set to the backup mode either by the 
watchdog timer circuit 218 or other switching circuitry 
(not shown). If the parity bit is correct, the microproces- 

15 sor 202 is allowed to proceed with retrieving the data. 

Parity error checking in accordance with the present 
invention thus overcomes the deficiencies of previous 
devices. In particular, parity error checking is preferably 
performed on all data stored in the internal RAM 210 

20 and the external RAM 144 (FIG. 1), rather than just on 
program instructions stored in RAM. The device 100 
thus increases the safety of the patient by providing in- 
creased error detection. 

Still further error checking is done by the address 

25 decoder 220. The address decoder 220 is preferably a 
conventional hardwired circuit. Before the microproces- 
sor 202 accesses an address location of the internal 
RAM 210, the ROM 212, or the external RAM 144, the 
address decoder 220 decodes the address and deter- 

30 mines if the address is a proper address. An example 
of an improper address is an address which is higher 
than the highest valid address location. If the address 
decoder 220 detects the microprocessor 202 attempting 
to access an improper address, the address decoder 

55 220 sends an error signal to the watchdog timer circuit 
218. If the address location is determined to be invalid 
and the device 100 is in the normal mode, the device 
1 00 is set to the intermediate mode either by the watch- 
dog timer circuit 218 or other switching circuitry (not 

40 shown). If the device 100 is in the intermediate mode 
and an address error is detected, the device 100 is set 
to the backup mode either by the watchdog timer circuit 
218 or other switching circuitry (not shown). 

Yet another type of error detection is provided by 

45 the opcode checker 226. The opcode checker 226 pref- 
erably is a conventional hardwired circuit. The opcode 
checker checks each opcode (which the microproces- 
sor 202 attempts to fetch) in order to determine if the 
opcode is valid. When the microprocessor 202 is about 

50 to fetch an opcode from the ROM 21 2, the internal RAM 
210, or the external RAM 144 (FIG. 1), the opcode 
checker 226 is notified via the data bus 204. The opcode 
checker then determines if the opcode is valid. If the op- 
code is not valid an error signal is generated and sent 

55 to the watchdog timer circuit 218. If the opcode is not 
valid and the device 100 is in the normal mode, the de- 
vice 100 is set to the intermediate mode either by the 
watchdog timer circuit 218 or other switching circuitry 
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(not shown). If an opcode error is detected while the de- 
vice 100 is in the intermediate mode, the device 100 is 
set to the backup mode either by the watchdog timer 
circuit 218 or other switching circuitry (not shown). If, 
however, the opcode is determined to be valid, the mi- 
croprocessor 202 is allowed to complete the fetch of the 
opcode. 

In a preferred embodiment of the present invention, 
each opcode comprises 8 bits. This gives a total of 256 
different 8-bit opcodes which can be used by the micro- 
processor 202. In a preferred embodiment, a relatively 
small number of the 256 opcodes available are unused 
and therefore invalid. Use of such an invalid opcode may 
cause the microprocessor 202 to function improperly, 
possibly causing the device to deliver inappropriate pac- 
ing therapy to the patient's heart. In a preferred embod- 
iment, the opcode checker 226 determines if the opcode 
which the microprocessor 202 is about to fetch is one of 
the unused opcodes by comparing the opcode to each 
of the unused opcodes and determining if there is a 
match. If the fetched opcode matches one of the unused 
opcodes, then the fetched opcode is invalid. If there is 
not a match, the opcode is a valid opcode. 

FIG. 5 shows the error checking routine which is 
carried out by the watchdog timer circuit 218 (FIG. 2) 
while the device 100 is in the normal mode. There are 
two errors which, if detected while the device 100 is in 
the normal mode at step 500, cause the device to enter 
the backup pacing mode. First, if the watchdog timer cir- 
cuit 218 (FIG. 2) is not correctly serviced by the micro- 
processor 202 (FIG. 2) at test 502, the watchdog timer 
circuit 218 (FIG. 2) sets the device 100 to the backup 
pacing mode. The tests carried out by the watchdog tim- 
er circuit 218 (FIG. 2) in order to determine if it is cor- 
rectly serviced by the microprocessor 202 (FIG. 2) are 
described above in reference to FIG. 4. Second, if a sys- 
tem interrupt is received from the telemetry circuit 112 
(FIG. 1) at test 504, the watchdog timer circuit 218 (FIG. 
2) sets the device 100 to the backup pacing mode. 

If a parity error, address error, or opcode error are 
detected while the device 1 00 is in the normal mode, the 
watchdog timer circuit 218 (FIG. 2) sets the device 100 
to the intermediate mode. At test 506 the watchdog timer 
circuit 218 (FIG. 2) determines if an error signal has 
been received from the parity checker 216 (FIG. 2). If 
an error signal has been received by the watchdog timer 
circuit 218 (FIG. 2) from the parity checker 21 6 (FIG. 2), 
the watchdog timer circuit 218 (FIG. 2) sets the device 
1 00 to the intermediate mode. At test 508 the watchdog 
timer circuit 218 (FIG. 2) determines if an error signal 
has been received from the address decoder 220 (FIG. 
2). If an error signal has been received by the watchdog 
timer circuit 218 (FIG. 2) from the address decoder 220 
(FIG. 2), the watchdog timer circuit 21 8 (FIG. 2) sets the 
device 100 to the intermediate mode. At test 510 the 
watchdog timer circuit 21 8 (FIG. 2) determines if an error 
signal has been received from the opcode checker 226 
(FIG. 2). If an error signal has been received by the 



watchdog timer circuit 218 (FIG. 2) from the opcode 
checker 226 (FIG. 2), the watchdog timer circuit 218 
(FIG. 2) sets the device 100 to the intermediate mode. 
If no errors are detected, the device 100 remains in the 

5 normal mode and the error checking routine of FIG. 5 is 
repeated by the watchdog timer circuit 218 (FIG. 2). 

As shown in FIG. 6, while the device 100 is in the 
intermediate mode at step 600, if the watchdog timer 
circuit 218 (FIG. 2) is not correctly serviced by the mi- 

10 croprocessor 202 (FIG. 2) at test 602, the watchdog tim- 
er circuit 218 (FIG. 2) sets the device 100 to the backup 
pacing mode. Again, the tests carried out by the watch- 
dog timer circuit 218 (FIG. 2) in order to determine if it 
is correctly serviced by the microprocessor 202 (FIG. 2) 

15 are described above with reference to FIG. 4. If a system 
interrupt is received from the telemetry circuit 112 (FIG. 

1) at test 604, the watchdog timer circuit 218 (FIG. 2) 
sets the device 100 to the backup pacing mode. 

If a parity error, address error, or opcode error is 
20 detected while the device 100 is in the intermediate 
mode, the watchdog timer circuit 218 (FIG. 2) sets the 
device 100 to the backup pacing mode. At test 606 the 
watchdogtimercircuit218 (FIG. 2) determines if an error 
signal has been received from the parity checker 216 
25 (FIG. 2). If an error signal has been received by the 
watchdog timer circuit 218 (FIG. 2) from the parity 
checker 216 (FIG. 2), the watchdog timer circuit 218 
(FIG. 2) sets the device 1 00 to the backup pacing mode. 
At test 608 the watchdog timer circuit 218 (FIG. 2) de- 
30 termines if an error signal has been received from the 
address decoder 220 (FIG. 2). If an error signal has 
been received by the watchdog timer circuit 218 (FIG. 

2) from the address decoder 220 (FIG. 2), the watchdog 
timer circuit 21 8 (FIG. 2) sets the device 1 00 to the back- 

55 up pacing mode. At test 610 the watchdog timer circuit 
218 (FIG. 2) determines if an error signal has been re- 
ceived from the opcode checker 226 (FIG. 2). If an error 
signal has been received by the watchdog timer circuit 
218 (FIG. 2) from the opcode checker 226 (FIG. 2), the 

40 watchdog timer circuit 218 (FIG. 2) sets the device 100 
to the backup pacing mode. If no errors are detected, 
the device 100 remains in the intermediate mode and 
the error checking routine of FIG. 6 is repeated by the 
watchdog timer circuit 218 (FIG. 2). 

45 The sequence of steps of FIG. 7 is preferably car- 
ried out by the watchdog timer circuit 218 (FIG. 2) in 
order to set the implantable cardiac stimulating device 
1 00 to the backup pacing mode. First, the watchdog tim- 
er circuit 21 8 (FIG. 2) issues a disable command at step 

50 700. This command disables the microprocessor 202 
(FIG. 2) at step 702 and gives control of the data bus 
204 (FIG. 2) to the telemetry circuit 140 (FIG. 1 ) at step 
704. The watchdog timer circuit 218 (FIG. 2) then acti- 
vates the backup pacing circuit 118 (FIG. 1) at step 706 

55 which preferably administers VVI pacing to the patient's 
heart 106. The implantable cardiac stimulating device 
1 00 preferably cannot exit the backup pacing mode until 
the device 100 is reset via the telemetry circuit 140 (FIG. 
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1) at test 708. Once a reset is issued, the device 100 
preferably is returned to the normal mode at step 710. 

In addition to the error detection methods and cir- 
cuitry described above, implantable cardiac stimulating 
device 100 also prevents errors which may be caused 
by transient electrical signals generated during the de- 
livery of a cardioversion or defibrillation shock. Referring 
again to FIG. 2, during the delivery of a cardioversion or 
defibrillation shock, signals generated by the microproc- 
essor 202 may be subjected to transient electrical sig- 
nals. These transient electrical signals may cause the 
signals produced by the microprocessor 202 to be al- 
tered. In order to prevent errors from occurring due to 
these transient electrical signals, the microprocessor 
202 is shut down during the delivery of a cardioversion 
or defibrillation shock as described in detail below. 

Additional error protection during the delivery of a 
cardioversion or defibrillation shock is provided by the 
gating circuit 206. The gating circuit 206 controls access 
to the interrupt registers 208 of the microprocessor 202. 
The interrupt registers 208 are used to alert the micro- 
processor 202 that an event has occurred that may re- 
quire the immediate attention of the microprocessor 
202. For example, sensing circuit 1 1 2 (FIG. 1 ) may send 
an interrupt signal to the microprocessor 202 if an elec- 
trical signal from the patient's heart 106 is detected. As 
another example, interrupt signals may also be issued 
by the telemetry circuit 140 (FIG. 1). 

During the delivery of a cardioversion or defibrilla- 
tion shock, transient electrical signals may cause any 
one of the interrupt registers 208 inadvertently to be set. 
This in turn will cause the microprocessor 202 to re- 
spond to the interrupt after the delivery of the cardiover- 
sion or defibrillation shock. In responding to such afalse 
interrupt the microprocessor 202 may cause the device 
100 to apply inappropriate pacing therapy or cardiover- 
sion/ defibrillation shocks to the patient's heart 106. In 
accordance with the present invention, the gating circuit 
206 is provided to prevent transient electrical signals 
from setting the interrupt registers, thereby increasing 
the safety of the patient. 

The gating circuit 206 preferably is a conventional 
hardwired circuit which can switch between two posi- 
tions. The first position of gating circuit 206 allows inter- 
rupt signals on the data bus 204 intended for the inter- 
rupt registers 208 to reach the interrupt registers 208. 
The second position of the gating circuit 206 does not 
permit interrupt signals on the data bus 204 to reach the 
interrupt registers 208. The gating circuit 206 is control- 
led by the microprocessor 202, whereby the microproc- 
essor 202 is able to select whether the gating circuit 206 
is in the first or second position. 

As shown in FIG. 8, in accordance with the present 
invention, just prior to the delivery of a cardioversion or 
defibrillation shock to the patient's heart 106, the micro- 
processor 202 (FIG. 2) programs the timer 224 (FIG. 2) 
at step 800 to send a wakeup signal to the system clock 
generator 228 (FIG. 2). The timer 224 (FIG. 2) is pro- 



grammed so that the wakeup signal is sent to the system 
clock generator 228 (FIG. 2) after a predetermined 
amount of time has passed, which predetermined 
amount of time is measured from the time at which the 
s timer 224 (FIG. 2) is programmed. The microprocessor 
202 (FIG. 2) then sends a signal to the gating circuit 206 
(FIG. 2) at step 802 which causes the gating circuit 206 
(FIG. 2) to switch to the second position in which signals 
are prevented from reaching the interrupt registers 208 
(FIG. 2). After switching the gating circuit 206 (FIG. 2), 
the microprocessor 202 (FIG. 2) generates a signal at 
step 804 which prevents the microprocessor 202 (FIG. 
2) from receiving clock signals from the system clock 
generator 228 (FIG. 2), thus halting the microprocessor 
202 (FIG. 2). After a predetermined amount of time 
which is longer than the time required to deliver the car- 
dioversion or defibrillation shock, the timer 224 (FIG. 2) 
issues the wake-up signal which causes clock signals 
from the system clock generator 228 (FIG. 2) to be re- 
ceived by the microprocessor 202 (FIG. 2) at step 806. 
The microprocessor 202 (FIG. 2) is then ableto continue 
processing. The microprocessor 202 (FIG. 2) then sets 
the gating circuit 206 (FIG. 2) back to the first position 
in which signals are allowed to reach the interrupt reg- 
isters 208 (FIG. 2) at step 808. In this manner, neither 
the interrupt registers 208 (FIG. 2) nor the signals pro- 
duced by the microprocessor 202 (FIG. 2) are subjected 
to the transient electrical signals generated during the 
delivery of a cardioversion or defibrillation shock. 

Referring again to FIG. 2, it is preferable to provide 
at least one interrupt register which preferably cannot 
be switched by the gating circuit 206. Preferably, a reset 
register (not shown) which is able to reset the micro- 
processor 202 cannot be switched off by the gating cir- 
cuit 206. It is therefore possible to reset the microproc- 
essor 202 should the microprocessor 202 malfunction 
and leave the gating circuit 206 in the second position 
in which the interrupt registers 208 are not accessible. 

It will be readily apparent to those skilled in the art 
that the microprocessor 202 can be shut down during 
the delivery of a cardioversion or defibrillation shock 
without isolating the interrupt registers 208. It will also 
be apparent that the interrupt registers 208 can be iso- 
lated during the delivery of a cardioversion or defibrilla- 
tion shock even if the microprocessor 202 is not shut 
down. 

An alternative embodiment of a processing and 
control unit (suitable for use as the processing and con- 
trol unit 114 of FIG. 1) is shown in FIG. 9. Processing 
and control unit 908 includes a data bus 904, an internal 
RAM 910, a ROM 912, a parity generator 914, a parity 
checker 916, a watchdog timer circuit 918, an address 
decoder 920, a real time clock logic 922, a timer 924, 
an opcode checker 926, and a system clock generator 
928, which work in substantially the same manner as 
described above in connection with the processing and 
control unit 200 of FIG. 2 and therefore will not be de- 
scribed further. 



15 



20 



25 



30 



35 



40 



45 



50 



10 



19 



EP 0 753 327 A2 



20 



In this embodiment, however, further error checking 
is provided by a microprocessor unit 950. The micro- 
processor unit 950 includes two microprocessors -- a 
first microprocessor 952 and a second microprocessor 
954, each of which is connected to a comparator/error 
detector 956 and an interface 958 which communicates 
with the data bus 904. Each of the first and second mi- 
croprocessors 952, 954 also preferably has a gating cir- 
cuit (not shown) which operates in substantially the 
same manner as the gating circuit 206 (FIG. 2) de- 
scribed above. 

In the processing and control unit 200 of FIG. 2, all 
signals which are intended for the microprocessor 202 
simply pass directly from the data bus 204 to the micro- 
processor. However, in the processing and control unit 
908 of FIG. 9, all signals which are directed to the mi- 
croprocessor unit 950 are first received by the interface 
958. 

As shown in FIG. 10, the interface 958 (FIG. 9) du- 
plicates the signals received from the data bus 904 (FIG. 
9) and sends one set of the signals to the first micro- 
processor 952 (FIG. 9) and another set of the signals to 
the second microprocessor 954 (FIG. 9) at step 1000. 
After the signals are processed by each of the first mi- 
croprocessor 952 (FIG. 9) and the second microproces- 
sor 954 (FIG. 9), the respective outputs are sent to the 
comparator/error detector 956 (FIG. 9) at step 1002. 
The comparator/error detector 956 (FIG. 9) compares 
the outputs of the first and second microprocessors 952, 
954 (FIG. 9) in order to determine if outputs of the first 
and second microprocessors 952, 954 (FIG. 9) are sub- 
stantially identical at step 1004. The comparator/error 
detector 956 (FIG. 9) determines that the microproces- 
sors 952, 954 (FIG. 9) are not functioning correctly if the 
processed signals from the first and second microproc- 
essors 952, 954 (FIG. 9) are not substantially identical. 
Accordingly, the comparator/error detector 956 (FIG. 9) 
determines that the microprocessors 952, 954 (FIG. 9) 
are functioning correctly if the processed signals from 
the first and second microprocessors 952, 954 (FIG. 9) 
are substantially identical. 

If the comparator/error detector 956 (FIG. 9) deter- 
mines that the outputs from the microprocessors 952, 
954 (FIG. 9) are not substantially identical, the compa- 
rator/error detector 956 (FIG. 9) issues an error detec- 
tion signal which is received by the watchdog timer cir- 
cuit 918 (FIG. 9) and causes the device 100 to enter the 
backup pacing mode at step 1006 (i.e., steps 700 
through 710 of FIG. 7 are carried out; however, in this 
embodiment both microprocessors are shut down). 
Therefore, a malfunction of either the first or second mi- 
croprocessor 952, 954 (FIG. 9) causes both microproc- 
essors 952, 954 (FIG. 9) to be disabled and the device 
1 00 to enter the backup pacing mode. If the device 1 00 
is in either the normal mode or the intermediate mode 
and the comparator/error detector 956 (FIG. 9) detects 
an error, the device 100 is put in the backup pacing 
mode. 



If, however, the comparator/error detector 956 (FIG. 
9) determines that the outputs of the first and second 
microprocessors 952, 954 (FIG. 9) are substantially 
identical, the processed signal is communicated to the 

5 interface 958 (FIG. 9) and then to the data bus 904 (FIG. 
9) at step 1008. 

Thus, an implantable cardiac stimulating device 
having safety optimization apparatus and methods in or- 
der to prevent inappropriate electrical stimulation from 

10 being delivered to a patient's heart has been described. 
Those skilled in the art will understand that the invention 
can be practiced in other than the described embodi- 
ments, which are presented for purposes of illustration 
and not of limitation, and the present invention is limited 

15 only by the claims which follow. 

Claims 

20 1. An implantable cardiac stimulating device (100) 
comprising: 

a microprocessor (202); 
a memory device (142) coupled to the micro- 
ns processor; 

a pulse delivery circuit (1 1 6), coupled to the mi- 
croprocessor, for delivering an electrical stimu- 
lation pulse to a patient's heart (106); 
a backup pacing circuit (118) for delivering 

30 backup pacing to the patient's heart; 

at least one error detection circuit (214, 216, 
218, 220, 222, 224, 226) for detecting errors in 
the implantable cardiac stimulating device; and 
switching circuitry (21 8), coupled to each of the 

55 microprocessor, the error detection circuit, and 

the backup pacing circuit, for switching the im- 
plantable cardiac stimulating device from a nor- 
mal mode to an intermediate mode in response 
to a first error detected by the error detection 

40 circuit, and for switching the implantable cardi- 

ac stimulating device from the intermediate 
mode to a backup pacing mode in response to 
a second error detected by the error detection 
circuit; wherein: 

45 while the implantable cardiac stimulating de- 

vice is in the normal mode, the pulse delivery 
circuit is controlled by the microprocessor, and 
the microprocessor is able to store data in and 
retrieve data from the memory device; 

50 while the implantable cardiac stimulating de- 

vice is in the intermediate mode, the pulse de- 
livery circuit is controlled by the microproces- 
sor, the microprocessor is able to store data in 
the memory device, and the microprocessor is 

55 able to retrieve data that have been stored in 

the memory device after the implantable cardi- 
ac stimulating device entered the intermediate 
mode; and 
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while the implantable cardiac stimulating de- 
vice is in the backup pacing mode, the backup 
pacing circuitry is activated. 

2. The device of Claim 1 , wherein the microprocessor 
(202) is disabled while the implantable cardiac stim- 
ulating device (100) is in the backup pacing mode. 

3. The device of Claim 1 or 2, wherein the error detec- 
tion circuit comprises: 

an address decoder (220) for detecting ad- 
dress errors in the device. 

4. The device of Claim 3, wherein the address decoder 
(220) decodes an address of a location of the mem- 
ory device (1 42) when the microprocessor (202) at- 
tempts to access the location in order to determine 
if the location is a valid location. 

5. The device of any preceding claim, wherein the er- 
ror detection circuit (214, 216, 218, 220, 222, 224, 
226) comprises: 

a parity checker (216) for detecting parity er- 
rors in the device. 

6. The device of Claim 5, wherein a plurality of data 
bytes are stored in the memory device (142), each 
of the data bytes comprising a plurality of data bits 
and a parity bit which indicates the parity of the data 
bits, and wherein the parity checker (216) compares 
the parity bit to the parity of the data bits in order to 
determine if the parity bit is correct. 

7. The device of any preceding claim, wherein the er- 
ror detection circuit comprises: 

an opcode decoder (226) for detecting op- 
code errors in the device. 

8. The device of Claim 7, wherein the opcode decoder 
(226) determines if an opcode which is about to be 
fetched by the microprocessor (202) is a valid op- 
code. 

9. The device of any preceding claim, further compris- 
ing: 



sor receives the interrupt signal, the watchdog 
timer circuit triggers the switching circuitry to 
switch the implantable cardiac stimulating de- 
vice (100) to the backup pacing mode. 

5 

10. The device of Claim 9, wherein the watchdog timer 
circuit (218) triggers the switching circuitry to switch 
the implantable cardiac stimulating device (100) to 
the backup pacing mode if more than one acknowl- 

10 edgment signal is received by the watchdog timer 
circuit within a predetermined interval of time. 

11. The device of Claim 9, wherein the circuitry for 
switching (218) comprises the watchdog timer cir- 

15 cuit. 

12. The device of Claim 9, wherein the watchdog timer 
c i rc u it (2 1 8) t ri gge rs th e s witch i n g c i rc u it ry to switch 
the implantable cardiac stimulating device (100) 

20 from the normal mode to the backup pacing mode 
or from the intermediate mode to the backup pacing 
mode. 

13. The device of any preceding claim wherein: 

25 

the pulse generating circuitry (116) comprises 
high voltage shocking circuitry (1 22) coupled to 
at least one output capacitor (124); and 
the error detection circuit (214, 216, 218, 220, 
30 222, 224, 226) comprises high voltage monitor- 

ing means (121) for monitoring either a prede- 
termined voltage on the output capacity or the 
amount of shock delivered to the patient. 

35 14. A method of operating an implantable cardiac stim- 
ulating device (100), the implantable cardiac stim- 
ulating device including a pulse delivery circuit (116) 
for delivering electrical stimulation pulses to a pa- 
tient's heart, a microprocessor (202), a memory de- 

40 vice (142), at least one error detection circuit (214, 
216, 218, 220, 222, 224, 226) for detecting errors 
in the implantable cardiac stimulating device, and a 
backup pacing circuit (118) for delivering backup 
pacing to the patient's heart, the method comprising 

45 the steps of: 

providing a normal mode of operation for the 
implantable cardiac stimulating device in which 
the pulse delivery circuit is controlled by the mi- 
croprocessor, wherein the microprocessor is 
able to store data in and retrieve data from the 
memory device; 

providing an intermediate mode of operation for 
the implantable cardiac stimulating device in 
which the pulse delivery circuit is controlled by 
the microprocessor, the microprocessor is able 
to store data in the memory device, and the mi- 
croprocessor is able to retrieve data that have 



interrupt generating circuitry (208) for generat- 
ing an interrupt signal which is received by the 
microprocessor (202), the microprocessor be- 
ing able to generate an acknowledgement sig- 50 
nal in response to receiving the interrupt signal; 
wherein the error detection circuit (214, 216, 
21 8, 220, 222, 224, 226) comprises a watchdog 
timer circuit (218); and 

wherein when the microprocessor does not 55 
communicate a proper acknowledgement sig- 
nal to the watchdog timer circuit within a prede- 
termined interval of time after the microproces- 



12 



23 



EP 0 753 327 A2 



24 



been stored in the memory device after the im- 
plantable cardiac stimulating device has en- 
tered the intermediate mode; 
providing a backup pacing mode of the implant- 
able cardiac stimulating device in which the 5 
backup pacing circuitry is activated; and 
switching the implantable cardiac stimulating 
device from the normal mode to the intermedi- 
ate mode in response to a first error detected 
by the error detection circuit, and switching the to 
implantable cardiac stimulating device from the 
intermediate mode to the backup pacing mode 
in response to a second error detected by the 
error detection circuit. 



15. The method of Claim 14, further comprising the step 
of: 

disabling the microprocessor (202) in re- 
sponse to the second error detected by the error 
detection circuit (214 (21 4, 21 6, 21 8, 220, 222, 224, 
226). 

16. The method of Claim 14 or 15, wherein the switch- 
ing step further comprises the step of: 

switching the implantable cardiac stimulating 
device (100) in response to an address error 
detected by the error detection circuit (214 
(214, 216, 218, 220, 222, 224, 226); or switch- 
ing the implantable cardiac stimulating device 
in response to a parity error detected by the er- 
ror detection circuit; or 

switching the implantable cardiac stimulating 
device in response to an opcode error detected 
by the error detection circuit. 

17. An implantable cardiac stimulating device (100) 
comprising: 

a first microprocessor (952); 
a second microprocessor (954); 
a backup pacing circuit (118); 
a comparator (956) coupled to each of the first 
and the second microprocessors; 
switching circuitry (91 8), coupled to each of the 
comparator and the backup pacing circuit, for 
activating the backup pacing circuit; 
an interface (958) coupled to each of the com- 
parator and the first and second microproces- 
sors; and 

a data bus (904) coupled to the interface, the 
interface receiving signals from the data bus 
and communicating the signals to each of the 
first and second microprocessors, the first mi- 
croprocessor processing the signals to produce 
a first processed signal, the second microproc- 
essor processing the signals to produce a sec- 
ond processed signal, each of the first and sec- 



ond processed signals being communicated to 
the comparator, the comparator comparing the 
first and second processed signals in order to 
determine if the first and second microproces- 
sors are functioning correctly; wherein: 
the switching circuitry activates the backup 
pacing circuit when the comparator determines 
that the first and second microprocessors are 
not functioning correctly 

18. The device of Claim 17, wherein the comparator 
(956) determines that the first and second micro- 
processors (952, 954) are not functioning correctly 
if the first and second processed signals are not 
substantially identical. 

19. The device of Claim 17, wherein the first and sec- 
ond microprocessors (952, 954) are disabled if the 
comparator (956) determines that the first and sec- 

20 ond microprocessors are not functioning correctly. 

20. A method of operating an implantable cardiac stim- 
ulating device (100), the implantable cardiac stim- 
ulating device having a first microprocessor (952), 

25 a second microprocessor (954), a comparator (956) 
coupled to each of the first and second microproc- 
essors, a data bus (904) coupled to each of the first 
and second microprocessors, and a backup pacing 
circuit (118), the method comprising the steps of: 

30 

communicating a signal from the data bus to 
each of the first and second microprocessors, 
the first microprocessor processing the signal 
to produce afirst processed signal, and the sec- 
55 ond microprocessor processing the signal to 

produce a second processed signal; 
communicating each of the first and second 
processed signals to the comparator; 
comparing the first and second processed sig- 
40 nals using the comparator in order to determine 

if the first and second microprocessors are 
functioning correctly; and 
activating the backup pacing circuit when the 
comparator determines that the first and sec- 
45 ond microprocessors are not functioning cor- 

rectly. 

21. An implantable cardiac stimulating device (100) for 
delivering an electrical shock to a patient's heart 

50 (106) comprising: 

circuitry (1 1 6) for delivering the electrical shock 
to the patient's heart; 

a microprocessor (202) for controlling the cir- 
55 cuitry; 

a system clock generator (228) for providing 

clock signals to the microprocessor; and 

a timer (224) which communicates with the mi- 
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processing means after a predetermined time 
interval after the electrical shock is delivered. 

27. The device of Claim 26, wherein the processing 
5 means (202) includes interrupt registers (208), and 

wherein the timing means (224) includes: 

means for disabling the interrupt registers just 
prior to the delivery of the electrical shock to the pa- 
tient's heart and for enabling the interrupt registers 
10 after a predetermined time interval after the electri- 
cal shock is delivered. 



croprocessor and the system clock generator, 
wherein: 

the timer is programmed by the microprocessor 
just prior to the delivery of the electrical shock 
to the patient's heart to send a wakeup signal 
to the system clock generator after a predeter- 
mined interval of time, the microprocessor 
sending a signal to the system clock generator 
to prevent the microprocessor from receiving 
clock signals from the system clock generator 
in order to halt processing by the microproces- 
sor, the microprocessor sending the signal just 
prior to the delivery of an electrical shock to the 
patient's heart, the timer generating the wake- 
up signal after the predetermined interval of 
time has elapsed, the wakeup signal enabling 
the microprocessor to receive the clock signals 
from the system clock generator in order to al- 
low processing by the microprocessor. 

22. The device of Claim 21, wherein the microproces- 
sor (202) has interrupt registers (208), and wherein 
the device further comprises: 

a gating circuit (206) controlled by the micro- 
processor, the gating circuit having a first position 
which allows signals to be communicated to the in- 
terrupt registers, and a second position which pre- 
vents signals from being communicated to the in- 
terrupt registers, the microprocessor switching the 
gating circuit from the first position to the second 
position just prior to the delivery of the electrical 
shock to the patient's heart. 

23. The device of Claim 22 or 29, wherein the micro- 
processor (202) switches the gating circuit (206) 
from the second position to the first position after 
the delivery of the electrical shock to the patient's 
heart. 

24. The device of Claim 21 or 29, wherein the electrical 
shock comprises one of a cardioversion shock or a 
defibrillation shock. 

25. The device of Claim 21 , wherein the predetermined 
interval of time is longer than the time of delivery of 
the electrical shock. 

26. An implantable cardiac stimulating device (100) for 
delivering an electrical shock to a patient's heart 
comprising: 

shocking means (1 1 6) for delivering the electri- 
cal shock to the patient's heart; 
processing means (202) for controlling the 
shocking means; and 

timing means (224) for disabling the processing 
means just prior to the delivery of the electrical 
shock to the patient's heart and for enabling the 



28. A method of operating an implantable cardiac stim- 
ulating device (100), the implantable cardiac stim- 

15 ulating device having pulse generating circuitry 
(116) for delivering electrical stimulation to a pa- 
tient's heart, a microprocessor (202), a timer (224) 
which communicates with the microprocessor, and 
a system clock generator (228) for providing clock 

20 signals to the microprocessor, the method compris- 
ing the step of: 

programming the timer just prior to the delivery 
of electrical stimulation to the patient's heart to 
25 send a wakeup signal to the system clock gen- 

erator after a predetermined interval of time; 
sending a signal to the system clock generator 
just prior to the delivery of electrical stimulation 
to prevent the microprocessor from receiving 
30 clock signals from the system clock generator 

in order to halt processing by the microproces- 
sor; 

wherein the timer generates the wakeup signal 
after the predetermined interval of time has 
35 elapsed, the wakeup signal enabling the micro- 

processor to receive the clock signals from the 
system clock generator in order to allow 
processing by the microprocessor. 

40 29. An implantable cardiac stimulating device (100) for 
delivering an electrical shock to a patient's heart 
(106) comprising: 



circuitry (1 1 6) for delivering the electrical shock 
45 to the patient's heart; 

a microprocessor (202) for controlling the cir- 
cuitry, the microprocessor having interrupt reg- 
isters (208), and 

a gating circuit (206) controlled by the micro- 
be processor, the gating circuit having a first posi- 
tion which allows signals to be communicated 
to the interrupt registers, and a second position 
which prevents signals from being communi- 
cated to the interrupt registers, the microproc- 
55 essor switching the gating circuit from the first 
position to the second position just prior to the 
delivery of the electrical shock to the patient's 
heart. 
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30. A method of operating an implantable cardiac stim- 
ulating device (100), the implantable cardiac stim- 
ulating device having pulse generating circuitry 
(116) for delivering electrical stimulation to a pa- 
tient's heart (106), a microprocessor (202) for con- s 
trolling the pulse generating circuitry, the microproc- 
essor having interrupt registers (208), a gating cir- 
cuit (206) connected to the microprocessor and 
having a first position which allows signals to be 
communicated to the interrupt registers, and a sec- to 
ond position which prevents signals from being 
communicated to the interrupt registers, comprising 

the steps of: 

switching the gating circuit from the first posi- 
tion to the second position just prior to the delivery is 
of electrical stimulation to the patient's heart in order 
to prevent the interrupt registers from receiving 
electrical signals during the delivery of electrical 
stimulating of the patient's heart. 

20 

31 . The method of Claim 30, further comprising the step 
of: 

switching the gating circuit from the second 
position to the first position after the delivery of the 
electrical shock to the patient's heart. 25 
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NTERRUPT SIGNAL ISSUED BY 300 
THE REAL TIME CLOCK LOGIC. 



INTERRUPT SIGNAL RECEIVED 3 02 
BY THE MICROPROCESSOR. 



MICROPROCESSOR ACKNOWLEDGES m 
THE INTERRUPT SIGNAL BY [/ 
WRITING A 6-BIT KEY TO THE 
ADDRESS SPECIFIED BY A 2-BIT 
ADDRESS CODE. 



WATCHDOG GENERATES A NEW 306 



PASSWORD COMPRISING A RANDOM 
6-BIT KEY AND A 2-BIT ADDRESS 
CODE. 



MICROPROCESSOR RETRIEVES THE / m 
NEW PASSWORD FOR USE IN THE NEXT 
ACKNOWLEDGEMENT. 



FIG. 3 
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FIG. 4 




IS THE 
ACKNOWLEDGEMENT 
RECEIVED BY THE 
WATCHDOG TIMER PROPER 
ACKNOWLEDGEMENT P 




THE DEVICE IS SET TO 
THE BACKUP PACING MODE. 
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DEVICE IN NORMAL MODE. 
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FROM FIG.5 FROM FIG.6 



WATCHDOG TIMER ISSUES 
OISABLE COMMAND. 



MICROPROCESSOR DISABLED. 



CONTROL OF DATA BUS 
GIVEN TO TELEMETRY 
CIRCUIT. 



BACKUP PACING CIRCUITRY 
ACTIVATED 
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DEVICE RETURNED TO 
THE NORMAL MODE. 

FIG. 7 
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TIMER SET TO GENERATE A 
WAKEUP SIGNAL AFTER A 
PREDETERMINED INTERVAL OF TIME. 



i 



800 



GATING CIRCUIT SWITCHED TO 
PREVENT SIGNALS FROM REACHING 
THE INTERRUPT REGISTERS. 



802 



MICROPROCESSOR SENDS SIGNAL TO 
SYSTEM CLOCK SO THAT 
MICROPROCESSOR NO LONGER RECEIVES 
CLOCK SIGNALS. 



804 



J 



TIMER ISSUES A WAKEUP SIGNAL 
TO ENABLE MICROPROCESSOR TO 
RECEIVE CLOCK SIGNALS. 
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GATING CIRCUIT SWITCHED TO 
ALLOW SIGNALS TO REACH 
THE INTERRUPT REGISTERS. 
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FIG. 8 
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INTERFACE DUPLICATES SIGNALS 
FROM DATA BUS AND SENDS ONE 
SET OF THE SIGNALS TO THE FIRST 
MICROPROCESSOR AND THE OTHER SET TO 
THE SECOND MICROPROCESSOR. 



OUTPUTS OF THE FIRST AND 
SECOND MICROPROCESSORS ARE SENT 
TO THE COMPARATOR. 



1002 



N 




1006 



DEVICE IS SET 
TO THE BACKUP 
PACING MODE. 



1008 



PROCESSED SIGNAL 
COMMUNICATED TO 
THE INTERFACE AND 
THEN TO THE DATA BUS. 

FIG. 10 
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